README.keychain

   1 Starting in 4.0 the keychain will be using content protection
   2
   3 We will define 4 new classes for the keychain:
   4
   5 Ak = non_exportable, uid_protection|pin_protection
   6 Ck = wrap_on_lock|unwrap_on_lock|non_exportable, uid_protection|pin_protection
   7 Dk = non_exportable, uid_protection
   8 Ek = wrap_on_lock|unwrap_on_lock|non_exportable, uid_protection|pin_protection
   9
  10 A new attribute will be added to all keychain items allowing a caller
  11 to specify the content protection level.
  12 Caller will have a choice or class Ak, Ck, Dk or Ek protection for the
  13 items data.
  14
  15 Consider whether or not to allow SecItemUpdate to change the protection class.
  16
  17 Backup will no longer directly backup the keychain file, instead a new
  18 SecKeychainMigrate() SPI will be added which takes a keybag and a password and
  19 returns a keychain blob in which class A and C items are protected by the
  20 provided keybags A and C keys, and the class E key protected items will not
  21 migrate.
  22
  23 Restore will pass the keychain file from an old backup or keychain blob
  24 returned by the new SPI and the backup keybag and password to securityd so
  25 items can be migrated back into the system keychain db.  Class E items in the
  26 backup set will only get restored if they are decryptable (restore is to same
  27 device) otherwise they are discarded during the restore.
  28
  29
  30 Implementors notes:
  31 Migrate will take a db file needing to be upgraded or a keychain blob
  32 needing to be migrated into the system security domain.